Re: Why are in-person meetings required for the debian keyring?
Sam Hartman <hartmans@debian.org> writes:
>>>>>> "Nikolaus" == Nikolaus Rath <Nikolaus@rath.org> writes:
> Nikolaus> However, it seems to me that meeting someone in person
> Nikolaus> isn't actually verifying the relevant identity here. My
> Nikolaus> trust in a Debian developer is not based on him holding a
> Nikolaus> particular legal name, it is in his history of
> Nikolaus> contributions. In other words: just because I'm sure about
> Nikolaus> someone's legal name, I wouldn't trust him to run code on
> Nikolaus> my computer. But if someone has been contributing to
> Nikolaus> Debian for 5 years with a specific GPG key, I'd probably
> Nikolaus> trust him to prepare a package no matter if the name
> Nikolaus> associated with the GPG key actually corresponds to some
> Nikolaus> legal identity or not.
>
> There are lots of types of trust involved.
> I definitely think past contributions is part of it.
> However, I also thing it's desirable that we have some probability of
> being able to engage a legal process if we needed to. Imagine someone
> intentionally uploaded some compromised software to Debian with the
> purpose of harming our users/turning debian machines into bots/etc.
I think that's a pretty weak argument. Even if you assume that a
theoretical perpetrator originally joined Debian with good intentions
(i.e., without using a faked id in the first place), and that you are
actually able to sue in the relevant country, you'd still have a very
hard time proving any malicious intention (the developer may just not
have noticed the compromising code). And that's probably a good thing, I
certainly don't want to be legally responsible if some software I
packaged happens to have a security bug that allows to compromise
someone's system.
Best,
-Nikolaus
--
GPG encrypted emails preferred. Key id: 0xD113FCAC3C4E599F
Fingerprint: ED31 791B 2C5C 1613 AF38 8B8A D113 FCAC 3C4E 599F
»Time flies like an arrow, fruit flies like a Banana.«
Reply to: